Sub-processor List
Last updated: August 17, 2026
1. Infrastructure Sub-processors
These entities provide the core cloud infrastructure and hosting environments where our platform and data reside.
| Sub-processor | Purpose | Entity Location |
|---|---|---|
| Amazon Web Services, Inc. (AWS) | Cloud computing infrastructure and platform services. Providing core infrastructure for the platform, including scalable object storage (S3), NoSQL database hosting (DynamoDB), and transactional email delivery (SES). This includes the hosting, backup, and processing of all application data. | USA (Global Regions) |
| Vercel, Inc. | Cloud platform for static hosting, Serverless Functions, and edge computing infrastructure. Hosting and deploying the web application front-end. This includes managing application traffic, executing serverless backend logic, caching content via Content Delivery Network (CDN), and collecting operational logs (e.g., deployment metadata and request headers). | USA |
2. Service-Specific Sub-processors
These entities provide specialized services required to operate the platform, handle communications, or manage financial transactions.
| Sub-processor | Purpose | Entity Location |
|---|---|---|
| Stripe, Inc. | Comprehensive payment processing and financial infrastructure platform. Facilitation of digital payment transactions, credit card processing, fraud detection (Stripe Radar), and financial reporting. This includes the secure handling of cardholder data and execution of payment instructions. | USA |
| Mercury Technologies, Inc. | Financial technology platform providing business banking services, treasury management, and payment processing. Facilitation of corporate banking operations, including the management of deposit accounts, domestic and international fund transfers (ACH, Wire), and corporate card issuance. | USA |
| Mango Technologies, Inc. (dba ClickUp) | Cloud-based collaboration and project management platform. Providing project tracking, task management, and technical customer service tasks. This includes the hosting of workspace data (tasks, docs, goals), team communication logs, and project-related attachments. | USA |
| Amazon Bedrock (Amazon Web Services, Inc.) | Generative AI inference platform. Running foundation model inference on customer content to power AI-assisted features of the platform, including assessment generation, evaluation, and related workflows. This includes the processing of prompts and customer-provided content submitted to the model, and the return of model outputs. | USA (Global Regions) |
| Google Workspace | Cloud-based productivity and collaboration tools, specifically Google Chat, for internal communication regarding customer data and support. | USA |
| Documenso, Inc. | Open-source electronic signature platform and document workflow service. Facilitation of the digital signing of documents, management of signing workflows, and the generation of audit trails. This includes hosting document content, recipient contact details, and cryptographic signature data. | USA |
| Xero Limited | Cloud-based accounting and business services platform. Providing accounting, bookkeeping, and financial management services, including the hosting of financial records, payroll processing, tax filing support, and automated bank reconciliation. | USA |
3. Affiliate Sub-processors
The following affiliates of the Company may also process data to provide administrative and management support.
| Sub-processor | Purpose | Entity Location |
|---|---|---|
| Pyrmont Holdings, Inc. | Internal business operations, including contract management, billing support, and accounting. | USA |
Updates and Notifications
We notify our customers of changes to this list in accordance with our DPA. Customers may subscribe to receive automated notifications of new Sub-processor additions by contacting our privacy team at privacy@upskillscore.com.
Due Diligence
Before engaging any Sub-processor, upSkillScore performs a security and privacy assessment to ensure the vendor maintains technical and organizational measures consistent with our own security standards and the requirements of applicable data protection laws (such as GDPR and CCPA).